Below is a ruggedised secure Saber (with speaker mike). These are
often used for military applications.

DVP What is it????

In this context DVP stands for Digital Voice Protection DVP (tm). DVP(tm)
is a Motorola Inc encryption system widely used in the USA and many other countries around
the world. Using DVP(tm) Two-Way radio users are protected from eavsdropping
through encryption of their signals. DVP(tm) is just one of several scrambling
systems sold by Motorola Inc.

The digital scrambling systems sold by Motorola include:DVP (Numbers on keypad of Code Inserter 0-7 inclusive) DVP-XL (Has numbers 0-9 and A-F inclusive on keypad of KVL)DES Reported to use the US Data Encryption Standard in CBC mode (DES)DES-XL Reported to use DES (Has numbers 0-9 and A-F inclusive on keypad of KVL)DVI Believed to be a version designed for export from the USA DVI-XL SPFL As above but with improvements Fascinator A more secret system apparently used by various US Government
users for national security applications.Indictor A digital scrambling system often used by military and federal
law enforcement users in the USA.

Note: In US patent No: 5,363,447 it is stated that DVI-XL is more secure than DVP-XL.

To the recreational radio scanner listener DVP transmissions can often be identified by
the unusual "white noise" or "static" sound. This noise is similar to
that of having an open squelch. The noise is in fact that of "data" being sent
at 12kbps. In Australia DVP and DVP-XL is mainly used by Government bodies. I
understand however that prawn trawlers in the North of Western Australia were also using
the system, perhaps there are other civilian users in Australia as well?

How Does it Work?
Speach is digitised using the CVSD method and then combined with a "random"
stream of data
generated by the secret key and the DVP encryption algorithm. The reverse process is
applied
to the receiving radio.

Is this gear available to the public?
In the USA DVP & DES systems are readily obtainable. Just a quick browse through the
USENET newsgroup rec.radio.swap will reveal a plethorah of scrambling gear for
sale. Most of the gear sold on rec.radio.swap is DES or DES-XL. I have seen on this
newsgroup a wide variety of gear that includes:

A few years back there was a realisation that DES might be getting a little dated. A group
in the USA called EFF (Electronic Frontiers Foundation) built a machine which can find a
DES key in several days. The details of the machine were published in a book called
"Cracking DES". The hardware was custom built and used purpose made ASIC.
The VHDL used to describe these ASIC s, schematics, programs in C were all included in
this book, the idea being that anyone could (in theory) make there own machine.
Perhaps this will result in DES based radio encryption gear being replaced with stronger
encryption schemes?

Here is a link to the EFF web site where you can see photographs of Deep Crack, there are
also links to online versions of the
book "Cracking DES".http://www.eff.org/descracker.html

DVP CODE INSERTERS(Also known as KVL's or Key
Variable Loaders for DES systems)The DVP Code inserters shown in the above photographs are used to load a secret key
into a DVP compatible radio. The key is entered into the Code Inserter by way of the
keypad. The key is transferred from the Code inserter to the radio using an interface
cable. (The interface cable is described in the "batwing" link in the
links section).

One Code Inserter may be used to program a huge number of radios. Thus Code Inserters
are much less common than DVP radios. To spell out how a Code Inserter is used:
(a)A key is typed into the DVP Code Inserter
(b)The key is loaded into compatible radio Number "1"
(c)The key is loaded into compatible radio Number "2"
(d)Radio Number "1" and radio Number "2" can now communicate using DVP

DVP Code Inserter general info
The Code Inserter shown above has a red LED type display. The display can show only 8
alphanumeric characters, for example:0 ErASEd This indicates that key memory number 0 is empty.LOAd _ This occurs after the LOAD
key is pressed. The Code Inserter is prompting for a memory location.
4.1 121394 This is a typical screen when loading a key. It indicates
memory number 4, line 1, and the first six digits of the key are 121394.

The case resembles that of the MX series handhelds. The keypad is a membrane type,
similar to that found on the old Sinclair ZX-81 computer or the keypad on some microwave
ovens.
*There are only 8 numeric keys 0-7 inclusive (more on the -XL versions)
*There is the standard MX type connector on the side of the unit (only some pins are used)
*There is a PTT style switch to load the key, even when the Code Inserter is turned off it
"wakes"
when this switch is depressed.
*Audible "beeps" are made during certain operations

SECURITY SYSTEMS
The keys stored in the Code Inserter will be lost if the battery (power supply) is
removed. To prevent unauthorised use of a Code Inserter to load an unauthorised radio with
a secret key a PIN type system can be implemented on the Code Inserter using the
"LOCK" key. The DVP code inserters are also called "keyloaders" by
some people. The name on the back of the T3010 units says "DVP Code Inserter". I
have learnt that there are different versions of the DVP Code Inserters. They are:
T3010AX Oldest
T3010BX
T3010CX
T3010DX More recent

There are a variety of other Motorola KVL's, eg the T3011

The DES keyloaders of the same generation as the T3010 are model number T3020
The DES keyloaders state on the ID plate that they are:

DES Key
Variable Loader

COMPATIBLE RADIOS
Radios generally require a special "DVP Module" in order to be able to transmit
and receive the encrypted signal. Motorola Inc refer to their range of radios capable of
encryption as "SECURENET (tm)" products. Not just any radio can take a DVP
module. For example a specific model of Motorola Saber (tm) is required before a "DVP
Module" can be fitted. The case on the SECURENET compatible radios is slightly longer
than the standard model. If a DVP/DES module is not fitted to a Saber then a
"dummy" module must be fitted (sometimes radio technicians solder a few wires to
avoid using the dummy module). From browsing the rec.radio.swap newsgroup I have
noted that the following radios are available with DVP as an option
Motorola Saber 1,2 &3 (See the picture near the top of this article)
Astro Saber
Astro Spectra
MTS 2000
MX300-R (This is a ruggedised version of the MX300S)
MX350
MX360
Syntor X 9000 .........please let me know if you have a complete list..

XTS3500 Handheld radio capable of being equipped with Fascinator(tm) or
Idictor(tm).

BASIC TECHNICAL DETAILS OF DVP (tm)Analogue to Digital ConversionA/D & D/A conversion using CVSD chip. Sampling Interval/Rate 12,000 bits per
secondCryptographic AlgorithmReported to be a Motorola proprietry algorithm
Self synchronising cypher (cipher if you are in the US) algorithmKey LengthA 24 digit number is entered using the keypad for each key.Number of possible keys 2.36 * 1021 (Note: This is not 2192
as might be expected from 24*8)
In fact 271 is equal to 2.3612*1021.
The process where a 24 digit number is converted to 71 bits of key is unknown to me. 71 is
an unusual length for a key.

There are a number of keys that are prohibited by the DVP Code Inserter.
Any key ending in the numbers 4,5,6 or 7 is prohibited. This markedly reduces the
number of
keys available.

This means keys:000000 000000 000000 000004 through to key777777 777777 777777 777774
are prohibited.
It also means keys:000000 000000 000000 000005 through to key777777 777777 777777 777775
are prohibited.
It also means keys:000000 000000 000000 000006 through to key777777 777777 777777 777776
are prohibited.
It also means keys:000000 000000 000000 000007 through to key777777 777777 777777 777777
are prohibited.

SOME OF THE PATENTS RELATED TO Motorola Inc
,SECURENET,DVP(tm),DES,DES-XL
Description of secure key management US Pat No: 5,363,447
Overview of DVP(tm) US Pat No: 4,167,700
Over the air re-keying of radios Nos: 5,301,232 also 5,528,691
DES-XL Keyloader design (Note this is a design) No: D390,554
The above patents can all be viewed on the IBM patent server http://www.patents.ibm.com
(Full content of patents scanned in here!)
Consult your legal representative regarding the legality of using information contained in
a patent

Non DVP Link http://www.racalcomm.com/products.htm
(Some government agencies appear to be moving towards Racal equipment, this site shows
some of the very capable gear that Racal sells. The "MBITR" covers 30-512Mhz in
a single handheld! Encryption using various algorithms is supported in many of these
units.)

Thanks
Thanks for visiting this page, please e-mail me at radioencryption@hotmail.com if you can help
with any information or have any comments.

NOTE:
*I am always looking for photos of scrambling gear. Please let me know if you can help

*I cannot help you to listen to DVP etc scrambled transmissions, because:
(a) I don't know how
(b) Even if I did know how (which I don't) I don't want to compromise the security of the
networks that use this gear.
*I do not work for Motorola Inc or any competitor
*SECURENET, DVP,DVP-XL,DES-XL,Fascinator,Indictor, etc are trademarks of Motorola
Inc
*If you feel that I have revealed information about DVP or any other encryption that I
should not have done, please let me know and I will remove it ASAP.